Investigation. KSC asset. Get asset details from KSC

1. Скачайте архив со скриптами по этой ссылке. В архиве вы найдете папку с плейбуками, которая содержит:
   • папку docs, которая содержит файлы с описанием работы плейбуков;
   • папку code, которая содержит файлы JSON с определениями плейбуков;
   • папку scripts, которая содержит скрипты Python, необходимые для выполнения пользовательских действий в плейбуке.
2. Сгенерируйте API-токен для всех методов API в api/v3/kuma.
3. В файле kuma_events.py укажите значения следующих констант:
   • HOST – введите FQDN или IP-адрес веб-сервера XDR;
   • TOKEN – введите API-токен, сгенерированный на предыдущем шаге.
4. Сгенерируйте API-токен с правами на взаимодействие с OpenAPI.
5. В файле xdr_open_api.py укажите значения следующих констант:
   • HOST – введите FQDN или IP-адрес веб-сервера XDR.
   • TOKEN – введите API-токен, сгенерированный на предыдущем шаге.
6. В файле xdr_link_events.py укажите значения следующих констант:
   • HOST – введите FQDN или IP-адрес веб-сервера XDR;
   • user – введите свое имя пользователя;
   • password – введите свой пароль.
7. Скопируйте файлы kuma_events.py, xdr_link_events.py, xdr_open_api.py и requirements.txt в директорию на удаленном клиентском устройстве.

   Директория скриптов по умолчанию – /opt/xdr_scripts. Если вы выберете другую директорию для скриптов, вам нужно изменить значение параметра workdir в поле Входные данные в дополнительных параметрах каждого затронутого шаблона плейбука.

8. На удаленном клиентском устройстве перейдите в директорию, содержащую файл requirements.txt, и выполните следующую команду для установки зависимостей:

   pip install -r requirements.txt

9. Настройте службу удаленного запуска скриптов и SSH-соединение.

{

"dslSpecVersion": "1.1.0",

"actionsSpecVersion": "1",

"playbookRunTimeout": "24h",

"executionFlow": [

{

"updateData": {

"action": "merge",

"filter": "${{ assets: ( [ alert.Assets[] | select(.Type == \"host\") ]) }}"

}

},

{

"loop": {

"input": "${[.assets[] + {workdir: .workdir} ]}",

"steps": [

{

"action": {

"function": {

"type": "executeCustomScript",

"params": {

"commandLine": "./xdr_open_api.py",

"commandLineParameters": "${\"get_host_details\"\n+ \" --device_fqdn \"\n+ .[0].Name\n+ \" --instance_id \"\n+ .[0].KSCServer}",

"workingDirectory": "${ .[0].workdir }"

}

},

"onError": "stop",

"timeout": {

"scheduleToCloseTimeout": "24h"

},

"output": {

"action": "merge",

"filter": "${{ asset_details: (.details.stdOut | try fromjson // {}) }}"

}

}

}

],

"onError": "stop",

"batchSize": 1,

"mode": "sequence",

"aggregate": "${.asset_details}",

"output": {

"filter": "${{ assets_details: . }}"

}

}

},

{

"loop": {

"input": "${[\n\t{\n\t\tassets_details: .assets_details[],\n\t\talert: alert,\n\t\tcheck_rules: .check_rules\n\t}\n]}",

"steps": [

{

"updateData": {

"action": "merge",

"filter": "${{ \n\tinput: .[0],\n\tasset_name: .[0].assets_details.KLHST_WKS_DN\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\trecent_creation_possible_infection: {\n \tresult: (\n \t(\n \t(\n \t(\n \t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n ) - (.input.assets_details.KLHST_WKS_CREATED_CONVERTED // 0)\n ) / 60 / 60 / 24 | floor\n ) < .input.check_rules.rule_recent_creation_possible_infection_days\n ),\n text: (\"Host created less than \" + (.input.check_rules.rule_recent_creation_possible_infection_days | tostring) + \" days ago (\" + (.input.assets_details.KLHST_WKS_CREATED| try (.value | tostring) // \"never\") + \") – may have already been infected.\")\n }\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tvisibility: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_LAST_VISIBLE_CONVERTED // 0)\n\t\t\t\t) / 60 / 60 | floor\n\t\t\t) > .input.check_rules.rule_visibility_hours\n\t\t),\n\t\ttext: (\"No visibility for more than \" + (.input.check_rules.rule_visibility_hours | tostring) + \" hours (since \" + (.input.assets_details.KLHST_WKS_LAST_VISIBLE| try (.value | tostring) // \"never\") + \") suggests the agent was stopped or the host is trying to hide.\")\n\t}\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tincomplete_status: {\n\t\tresult: (\n\t\t\t.input.assets_details.KLHST_WKS_STATUS_CONVERTED \n\t\t\t| (\n\t\t\t\tany(. == \"Host is visible\") \n\t\t\t\tand any(. == \"Network Agent is installed\")\n\t\t\t\tand any(. == \"Network Agent is alive\")\n\t\t\t\tand any(. == \"Real-time protection is installed\")\n\t\t\t) | not\n\t\t),\n\t\ttext: (\n\t\t\t.input.assets_details.KLHST_WKS_STATUS_CONVERTED \n\t\t\t| \"Any missing status in Host Status indicates the host is unprotected or the agent is disabled. \" \n\t\t\t\t+ (if (any(.==\"Host is visible\")|not) \n\t\t\t\t\t\tthen \"\\n\\t- \\\"Host is visible\\\" is false\" \n\t\t\t\t\t\telse \"\" \n\t\t\t\t\tend)\n\t\t\t\t+ (if (any(.==\"Network Agent is installed\")|not) \n\t\t\t\t\t\tthen \"\\n\\t- \\\"Network Agent is installed\\\" is false\" \n\t\t\t\t\t\telse \"\" \n\t\t\t\t\tend)\n\t\t\t\t+ (if (any(.==\"Network Agent is alive\")|not) \n\t\t\t\t\t\tthen \"\\n\\t- \\\"Network Agent is alive\\\" is false\" \n\t\t\t\t\t\telse \"\" \n\t\t\t\t\tend)\n\t\t\t\t+ (if (any(.==\"Real-time protection is installed\")|not) \n\t\t\t\t\t\tthen \"\\n\\t- \\\"Real-time protection is installed\\\" is false\" \n\t\t\t\t\t\telse \"\" \n\t\t\t\t\tend)\n\t\t)\n\t}\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tav_base_update: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_LAST_UPDATE_CONVERTED // 0)\n\t\t\t\t) / 60 / 60/ 24 | floor\n\t\t\t) > .input.check_rules.rule_av_base_update_days\n\t\t),\n\t\ttext: (\"Last AV-base update is older than \" + (.input.check_rules.rule_av_base_update_days | tostring) + \" days (\" + (.input.assets_details.KLHST_WKS_LAST_UPDATE| try (.value | tostring) // \"never\") + \") host may not receive current signatures or policies.\")\n\t}\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tnagent_disconnect: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_LAST_NAGENT_CONNECTED_CONVERTED // 0)\n\t\t\t\t) / 60 / 60 | floor\n\t\t\t) > .input.check_rules.rule_nagent_disconnect_hours\n\t\t),\n\t\ttext: (\"Prolonged interval more than \" + (.input.check_rules.rule_nagent_disconnect_hours | tostring) + \" hours without a Network Agent connection points to a disabled agent or deliberate isolation from the management server.\")\n\t}\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tfull_scan_overdue: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_LAST_FULLSCAN_CONVERTED // 0)\n\t\t\t\t) / 60 / 60 / 24 | floor\n\t\t\t) > .input.check_rules.rule_full_scan_overdue_days\n\t\t),\n\t\ttext: (\"More than \" + (.input.check_rules.rule_full_scan_overdue_days | tostring) + \"  days since the last full scan (\" + (.input.assets_details.KLHST_WKS_LAST_FULLSCAN| try (.value | tostring) // \"never\") + \") – malicious files could remain undetected.\")\n\t}\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tvirus_count_nonzero: {\n\t\tresult: (\n\t\t\t.input.assets_details.KLHST_WKS_VIRUS_COUNT_CONVERTED > 0\n\t\t),\n\t\ttext: (\"Virus count is \" + (.input.assets_details.KLHST_WKS_VIRUS_COUNT_CONVERTED | tostring) + \". Any non‑zero virus count must be investigated (file names, categories, severity).\")\n\t}\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\trtp_error: {\n\t\tresult: (\n\t\t\t.input.assets_details.KLHST_WKS_RTP_ERROR_CODE > 0\n\t\t),\n\t\ttext: (\"Real-time protection state is \" + (.input.assets_details.KLHST_WKS_RTP_STATE_CONVERTED | tostring) + \" - AV module problem, possibly disabled protection.\")\n\t}\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\thost_status_critical: {\n\t\tresult: (\n\t\t\t.input.assets_details.KLHST_WKS_STATUS_ID == \"Critical\"\n\t\t),\n\t\ttext: (\"Host marked Critical due to the following reasons: \" + (.input.assets_details.KLHST_WKS_STATUS_MASK_CONVERTED | tostring) + \".\")\n\t}\n}}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\trtp_av_base_update: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_RTP_AV_BASES_TIME_CONVERTED // 0)\n\t\t\t\t) / 60 / 60/ 24 | floor\n\t\t\t) > .input.check_rules.rule_rtp_av_base_update_days\n\t\t),\n\t\ttext: (\"Last RTP AV-base update is older than \" + (.input.check_rules.rule_rtp_av_base_update_days | tostring) + \" days (\" + (.input.assets_details.KLHST_WKS_RTP_AV_BASES_TIME| try (.value | tostring) // \"never\") + \") host may not receive current signatures or policies.\")\n\t}\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\tlast_system_restart: {\n\t\tresult: (\n\t\t\t(\n\t\t\t\t(\n\t\t\t\t\t(\n\t\t\t\t\t\t.input.alert.OriginalEvents[0].EndTime / 1000 | floor\n\t\t\t\t\t) - (.input.assets_details.KLHST_WKS_LAST_SYSTEM_START_CONVERTED // 0)\n\t\t\t\t) / 60 / 60 | floor\n\t\t\t) < .input.check_rules.rule_last_system_restart_hours\n\t\t),\n\t\ttext: (\"System reboots occurring more often than once per \" + (.input.check_rules.rule_last_system_restart_hours | tostring) + \" hours without a legitimate reason may indicate instability or attempts to restart malicious processes. System started at \" + (.input.assets_details.KLHST_WKS_LAST_SYSTEM_START| try (.value | tostring) // \"never\") + \".\")\n\t}\n}\n}"

}

},

{

"updateData": {

"action": "merge",

"filter": "${{\n\treboot_request: {\n\t\tresult: (\n\t\t\t.input.assets_details.KLHST_WKS_RBT_REQUIRED\n\t\t),\n\t\ttext: (\"Any reboot request logged without a valid reason could be an attempt to launch malware after reboot. Reboot reasons: \" + (.input.assets_details.KLHST_WKS_RBT_REQUEST_REASON_CONVERTED | tostring) + \".\")\n\t}\n}}"

}

}

],

"onError": "stop",

"batchSize": 1,

"mode": "sequence",

"aggregate": "${. | del(.input)}",

"output": {

"filter": "${{ check_result: . }}"

}

}

},

{

"action": {

"function": {

"type": "addCommentToAlert",

"params": {

"text": "${[\n .check_result[] \n\t\t| \"Potential vulnerabilities of host \"\n\t\t\t+ .asset_name\n\t\t\t+ \"\\n\"\n\t\t\t+ ( [ del(.asset_name) \n\t\t\t\t\t| to_entries[] \n\t\t\t\t\t| select(.value.result)\n\t\t\t\t\t| \" - \"\n\t\t\t\t\t\t+ .key \n\t\t\t\t\t\t+ \": \" \n\t\t\t\t\t\t+ .value.text] \n\t\t\t\t| join(\"\\n\") )\n] | join(\"\\n\\n\")}"

}

},

"onError": "stop",

"timeout": {

"scheduleToCloseTimeout": "24h"

}

}

}

],

"input": "${{\n\t\"workdir\": \"/opt/xdr_scripts\",\n\t\"max_assets_count\": 5,\n\t\"check_rules\": {\n\t\t\"rule_recent_creation_possible_infection_days\": 7,\n\t\t\"rule_visibility_hours\": 24,\n\t\t\"rule_av_base_update_days\": 30,\n\t\t\"rule_nagent_disconnect_hours\": 3,\n\t\t\"rule_full_scan_overdue_days\": 14,\n\t\t\"rule_rtp_av_base_update_days\": 30,\n\t\t\"rule_last_system_restart_hours\": 24\n\t}\n}}"

}